MARSHALL DENNEHEY 

WARNER COLEMAN &GOGGIN 


ATTORNEYS'AT-LAW WWW.MARSHALLDENNEHEY.COM 


A PROFESSIONAL CORPORATION 

2000 Market Street, Suite 2300 • Philadelphia, PA 19103 
(215) 575-2600 • Fax (215) 575-0856 

Direct Dial: 215-575-2615 
Email: djshannon@mdwcg.com 


PENNSYLVANIA 
Allentown 
Doylestown 
Erie 
Harrisburg 
King of Prussia 
Philadelphia 
Pittsburgh 
Scranton 

NEW JERSEY 
Cherry Hill 
Roseland 

DELAWARE 

Wilmington 


OHIO 

Cincinnati 

Cleveland 

FLORIDA 
Ft. Lauderdale 
Jacksonville 
Orlando 
Tampa 

NEW YORK 
Long Island 
New York City 
Westchester 


May 25,2018 


Via Email: Idtheft@oag.state.md.us 

Attorney General Brian E. Frosh 
Office of the Attorney General 
Attn: Security Breach Notification 
200 St. Paul Place 
Baltimore, MD 21202 

RE: Abod & Caruso, LLC 

Our File No . 0494MQ125 


Dear Attorney General Frosh: 

Pursuant to Maryland Code Ann., Com. Law § 14-3504(h), we are writing to notify you of a data 
security incident involving 1,080 Maryland residents. We are submitting this notification on behalf of our 
client, Abod & Caruso, LLC. 

Nature Of The Security Breach 

Abod & Caruso is a law firm based in Gaithersburg, Maryland. On April 2, 2018, Abod & Caruso 
became aware that a hard drive containing information on closed client files was accessed without authorization 
on that date. As a result, some of the personal information belonging to Maryland residents may have been 
exposed to others, including first and last names, home addresses, social security numbers and/or alien 
registration numbers. 

The residents involved in this incident were forwarded letters notifying them of this incident on May 17, 
2018. A copy of the form letter is attached hereto. 

Steps Taken Relating To The Incident 

Upon discovering the incident, Abod & Caruso immediately had the device that was accessed taken off¬ 
line so that the files contained on the device could no longer be accessed. Abod & Caruso's forensic 
inf ormation technology personnel analyzed the compromised device and conducted an internal root-cause 
analysis to determine how this incident occurred and who was impacted. The analysis to date has revealed that 
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unauthorized access occurred but Abod & Caruso has found no evidence that any personal information was in 
fact compromised or taken. 

To prevent a similar incident from happening in the future, Abod & Caruso engaged an independent 
computer forensic firm to ensure that its internal systems are secure. Abod & Caruso is also in the process of 
reviewing its internal policies and data management protocols and has implemented enhanced security 
measures. All employees will be retrained on cybersecurity and privacy best practices. 

Abod & Caruso has also arranged to have Experian monitor the affected individuals' credit for one year 
at no cost to them through its IdentityWorks SM credit monitoring services. 

Should you need additional information regarding this matter, please contact me. 


Very truly yours, 

0 . 5 . 

DAVID J. SHANNON 


D J S :j 1 
Enel. 



Abod & Caruso, LLC 

Attorney? flnd Counselors at Law 
18524 Office Park Drive 
Gaithersburg, MD 20882 
Telephone: (202)462-9701 
Facsimile: (202)609-9921 


DATE 

NAME 

STREET ADDRESS 
CITY, STATE and ZIP 


Dear [NAME], 

Our firm represents individuals in various legal matters. The privacy and protection of our client's, and your 
information, is a matter that we take very seriously. We are writing to inform you of a data incident at Abod & 
Caruso, LLC that may involve some of your personal information. 

What Happened , , 

On April 2,2018, a hard drive containing information on closed client files was accessed without authorization. 
The device that was accessed was immediately taken off-line however some files contained on the device could 
have been accessed during this brief period. Your personal information may have been in these files. 

What Infor mation Was Involved f . 

Based on our investigation into this matter, we have determined that the personal information which may have 
been accessed includes first and last names, home addresses, social security numbers and/or alien registration 
numbers. 

What We Are Doing , 

Immediately after the incident was discovered, we conducted an internal root-cause analysis to determine how 
this incident occurred and who was impacted. Our analysis to date has determined that an unauthorized access 
occurred but we have found 110 evidence that any personal information was m fact compromised or taken. 

To prevent a similar incident from happening in the future, we have engaged an independent computer forensic 
firm to ensure that our internal systems are secure. Our forensic information technology personnel analyzed the 
compromised device and immediately removed it from our computer system. We are also in the process of 
reviewing internal policies and data management protocols and have implemented enhanced security measures. 
All employees will be retrained on cybersecurity and privacy best practices. 

What we are doing to protect your information: 

To help protect your identity, we are offering a complimentary one-year membership of Experian's® 
ldentityWorks SM , This product provides you with superior identity detection and resolution of identity theft. To 
activate your membership and start monitoring your personal information please follow the steps below: 

* Ensure that you enroll by: August SI, 2018 (Your code will not work after this date,) 

* Visit the Experian ideritltyWorks website to enrol): www.cxpciianidworks.com/3beredit 

* Provide your activation code: [GQD El 

If you have questions about the product, need assistance with identity restoration or would like an alternative to 
enrolling in Experian tdentityWorks online, please contact Experian's customer care team at 877.890.9332 by 
August 31, 2018, Be prepared to provide engagement number # DB06833 as proof of eligibility for the identity 
restoration services by Experian. 


ADDITIONAL DETAILS REGARDING YOUR 12-MONTH EXPERIAN IDENTiTYWORKS MEMBERSHIP: 



A credit card is not required for enrollment In Experian IdentityWorks. 

You can contact Experian immediately regarding any fraud issues, and have access to the following features 
once you enroll in Experian IdentityWorks; 

" Experian credit report at signup: See what information is associated with your credit file. Daily credit 
reports are available for online members only.* 

* Credit Monitoring; Actively monitors Experian file for indicators of fraud. 

» Identity Restoration: Identity Restoration agents are immediately available to help you address credit 
and non-credit related fraud. 

- Experian IdentityWorks ExtendCARE™: You receive the same high-level of Identity Restoration support 
even after your Experian IdentityWorks membership has expired. 

* Up to $1 Million Identity Theft insurance**: Provides coverage for certain costs and unauthorized 
electronic fund transfers. 


If you believe there was fraudulent use of your information and would like to discuss how you may be able to 
resolve those issues, please reach out to an Experian agent at 877.890.9332. If, after discussing your situation 
with an agent, it is determined that Identity Restoration support is needed, then an Experian Identity 
Restoration agent is available to work with you to investigate and resolve each incident of fraud that occurred 
(including, as appropriate, helping you with contacting credit grantors to dispute charges and close accounts; 
assisting you fn placing a freeze on your credit file with the three major credit bureaus; and assisting you with 
contacting government agencies to help restore your identity to its proper condition), 

Piease note that this Identity Restoration support is available to you for one year from the date of this letter and 
does not require any action on your part at this time. The Terms and Conditions for this offer are located at 
www.ExperlanlDWorks.com/restoratlon . You will also find self-help tips and information about identity 
protection at this site. 

We sincerely apologize far this Incident and regret any inconvenience it may cause you. Should you have 
questions or concerns regarding this matter, please do not hesitate to contact us at (202) 462-9701. 


Sincere!' 



Curtis P. Abod 
Member 

Abod & Caruso, LLC 


* Offline members wilt be eligible to call for additional reports quarterly after enrolling 

** Identity theft insurance Is underwritten by insurance company subsidiaries or affiliates of American International Group, Inc. (AlG). 
The description herein Is a summary and intended for informational purposes only and does not include all terms, conditions and 
exclusions of the policies described, Please refer to the actual policies for terms, conditions, and exclusions of coverage. Coverage may 
not be available in all Jurisdictions 


Information about Identity Theft Prevention, 

We recommend that you regularly review statements from your accounts and periodically obtain your credit report 
from one or more of the national credit reporting companies. You may obtain a free copy of your credit report online at 
rvmv.aimtialcreditreport.com, by calling toll-free 1-877-322-8228, or by mailing an Annual Credit Report Request 
Form (available ativww.ammalcreditreport.coni) to: Annual Credit Report Request Sendee, P , 0 , Box 105281, Atlanta, 
GA, 30348-5281. You may also purchase a copy ofyour credit report by contacting one or more of the three national 
credit reporting agencies listed below. 



Equifax: F.O. Box 740241, Atlanta, Georgia 30374-0241,1-800685-mh wTO.equifax.com 

Experian: F.O. Box 9532, Allen, TX 750*3, 1-888-397-3742, wivw.experian.com 

TransUnion: F.O. Box 1000, Chester, PA 19022,1-800-888-4213, wtTO.transumon.com 

When you receive your credit reports, review them carefiilly. Look for accounts or creditor inquiries that you did not 
initiate or do not recognize. Look for information, such as home address and Social Security number, that is not 
accurate. If you see anything you do not understand, call the credit reporting agency at the telephone number on the 
report 

We recommend you remain vigilant with respectto reviewing your account statements and credit reports, and 
promptly report any suspicious activity or suspected identity theft to the proper law enforcement authorities, including 
local law enforcement, your state's attorney general and/or the Federal Trade Commission (“FTC’O* You may contact 
the FTC or your state's regulatory authority to obtain additional information about avoiding identity theft, 

Federal Trade Commission, Consumer Response Center,6 00 Pennsylvania Avenue, NW, Washington, DC 
20580,1-877-IDTHEFr (438-4338), wwwitc.gov/idtheft 

For residents of Maryland: You may also obtain information about preventing and avoiding identity theft from 
the Maryland Office of the Attorney General: Maryland Office of the Attorney General, Consumer Protection 
Division 200 St. Faul Place, Baltimore, MD 21202,1-888-743-OD23, wTO.oag .statejnd.us 

For residents of North Carolina, t You may also obtain information about preventing and avoiding identity 
theft from the North Carolina Attorney Generali Office: North Carolina Attorney GeneraPs Office, 
Consumer Protection Division, 9001 Mail Service Center, Raleigh, NC 27699-9001,1-877-5-NO-SCAM, 
www.ncdoigov 


You may want to order copies of your credit reports and check for any bills thatyott do not recognize, if you find 
anything auspicious, call the credit reporting agency at the phone number on the report. Keep a copy of this notice for 
your records in case of future problems with your records, If you are a California resident, we suggest thatyou visit the 
web site of the California Office of Privacy Protection at www.privacy.ca.gov to find more information about your 
privacy. 

Fraud Alerts: There are also two types of fraud alerts that you can place on your credit report to put your creditors on 
notice that you may be a vie l ini of fraud: an initial alert and an extended alert. You may ask that an initial fraud alert be 
placed on your credit report if you suspect you have been, or are about to be, a victim of identity theft An initial fraud 
alert stays on your credit report for at least 90 days. You may have an extended alert placed on your credit report if you 
have already been a victim of identity theft ’with the appropriate documentaiy proof. An extended fraud alert stays on 
your credit report for 7 years. You can place a fraud alert on your credit report by calling the toll-free fraud number of 
any of the three national credit reporting agencies listed below, 

Equifax: 1-888-766-0008, ’www.equifax.com. 

Experian: i- 888-397’374 2 > www.experian.com 

TransUnion: >800-680-7289, fraud.trEUisunion.com 

Credit Freezes: You may have the right to put a credit freeze, also known as a security freeze, on your credit file, so 
that no new credit can be opened in your name without the use of a PIN number that is issued to you when you initiate 
a freeze. A credit freeze is designed to prevent potential credit grantors from accessing your credit report without your 
consent. If you place a credit freeze, potential creditors and other third parties will not be able to get access to your 
credit report unless you temporaiily lift the freeze. Therefore, using a credit freeze may delay your ability to obtain 
credit. In addition, you may incur fees to place, lift and/or remove a credit freeze. Credit freeze laws vary from state to 
state. The cost of placing, temporarily lifting, and removing a credit freeze also varies by state, generally $5 to $ 20 per^ 
action at each credit reporting company. Unlike a fraud alert, you must separately place a credit freeze oriyouv credit 
file at each cvedi t vepovting compcmi/. Since the instructions for how to establish a credit freeze differ from state to 
state, please contact the three major credit reporting companies as specified, below to find out more information: 

Equifax: P.Q, Box 105788, Atlanta, GA30348, www.equifax.com 

Experian: JP.O. Box 9554 , Allen, TX 75013, wmv.experian.com 

TransUnion L 1 C: P.O. Box 2000, Chester, FA, 19022-2000, freezetonsunion.com 

You can obtain more information about fraud alerts and credit freezes by contacting the FTC or one of the national 
credit reporting agencies listed above. 



